@sublang/playbook 15.0.0 → 16.0.0

package/src/xstate-playbook-runtime.ts

@@ -158,7 +158,7 @@ export interface RuntimeBoundaryCalls {
    * with the cause the boundary decided at the call itself, where the role,
    * the resolved player, and the reported error are known.
    */
-  markPlayerResultFailure?(error: Error): Error;
+  markPlayerResultFailure?(error: Error, result?: PlayerResult): Error;
   callJudge(
     purpose: JudgePurpose,
     stateId: string | undefined,
@@ -284,12 +284,12 @@ const GOVERNED_JUDGE_FAILURE_REASONS: readonly string[] = [
   'semantic correction budget is unavailable',
 ];
 
-const ABORTED_FAILURE_CAUSE: PlaybookFailureCause = assertPlaybookFailureCause({
+export const ABORTED_FAILURE_CAUSE: PlaybookFailureCause = assertPlaybookFailureCause({
   code: 'aborted',
   evidence: {},
 });
 
-function runtimeDefectCause(reason: string): PlaybookFailureCause {
+export function runtimeDefectCause(reason: string): PlaybookFailureCause {
   return assertPlaybookFailureCause({
     code: 'runtime-defect',
     evidence: { reason: reason.length === 0 ? 'unknown runtime defect' : reason },
@@ -315,7 +315,7 @@ function failureErrorCode(error: unknown): string | undefined {
   }
 }
 
-function playerFailureCause(input: {
+export function playerFailureCause(input: {
   readonly roleId: string;
   readonly playerId?: string;
   readonly error: unknown;
@@ -336,6 +336,84 @@ function playerFailureCause(input: {
   });
 }
 
+/**
+ * DR-063 §1: the cause of an unresolved governed settlement. A reconciled
+ * mismatch supplies its own receipt-read cause; the reasons a runtime owns map
+ * to adjudication, abort, and runtime-defect codes. Exported so linked
+ * machinery of an artifact's own decides the same reasons.
+ */
+export function governedSettlementCause(
+  reason: string,
+  error: unknown,
+  aborted: boolean,
+  supplied: PlaybookFailureCause | undefined,
+): PlaybookFailureCause {
+  if (supplied !== undefined) return supplied;
+  if (aborted || reason.includes('aborted')) return ABORTED_FAILURE_CAUSE;
+  if (GOVERNED_JUDGE_FAILURE_REASONS.includes(reason)) {
+    const transport = failureErrorEvidence(error);
+    return assertPlaybookFailureCause({
+      code: 'judge-failed',
+      evidence: {
+        reason,
+        ...(transport === undefined ? {} : { error: transport }),
+      },
+    });
+  }
+  return runtimeDefectCause(reason);
+}
+
+/**
+ * DR-063 §2: the causes decided for thrown values that cannot carry the
+ * marker — a string, a frozen error — and for the record a machine keeps in
+ * place of the thrown value, kept by identity for as long as the failure
+ * stands, so every surface that reads the FSM's own `lastError` publishes the
+ * cause decided for exactly that failure, whatever turn reads it. A value
+ * that carries the marker answers from it; the map is bounded, since only
+ * values that lack the marker need an entry.
+ */
+export interface PlaybookFailureCauseRetention {
+  retain(error: unknown, cause: PlaybookFailureCause): void;
+  causeOf(error: unknown): PlaybookFailureCause | undefined;
+}
+
+const FAILURE_CAUSE_RETENTION_LIMIT = 8;
+
+export function createFailureCauseRetention(): PlaybookFailureCauseRetention {
+  const causes = new Map<unknown, PlaybookFailureCause>();
+  return {
+    retain(error, cause) {
+      if (error === undefined || error === null) return;
+      causes.delete(error);
+      causes.set(error, cause);
+      while (causes.size > FAILURE_CAUSE_RETENTION_LIMIT) {
+        causes.delete(causes.keys().next().value);
+      }
+    },
+    causeOf(error) {
+      if (error === undefined || error === null) return undefined;
+      return normalizeError(error).cause ?? causes.get(error);
+    },
+  };
+}
+
+/**
+ * DR-063 §2: the value an invoked actor's rejection carried into the machine,
+ * read from the XState error event that delivered it, or `undefined` for any
+ * other event.
+ */
+function actorErrorOf(event: unknown): unknown {
+  if (typeof event !== 'object' || event === null) return undefined;
+  try {
+    const { type, error } = event as { type?: unknown; error?: unknown };
+    return typeof type === 'string' && type.startsWith('xstate.error.actor.')
+      ? error
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 
 // ---------------------------------------------------------------------------
 // DR-028: both call boundaries treat an `ok` result whose `finalText` is
@@ -448,6 +526,23 @@ type XStateEffectBoundarySeed = Omit<
   'playbookId' | 'canonicalWorktree' | 'baseline' | 'cohortId'
 >;
 
+/** One member's completion inside a repository cohort (DR-067 §1). */
+type XStateRepositoryCohortCompletion<T> =
+  XStateRepositoryExclusiveCompletion<T> & { readonly roleId: string };
+
+interface XStateRepositoryCohortResult<T> {
+  readonly baseline: PlaybookRepositoryReceipt['baseline'];
+  readonly invocationId: string;
+  readonly operations: Readonly<
+    Record<
+      string,
+      XStateRepositoryOperationSettlement<T> | XStateRepositoryOperationRejection
+    >
+  >;
+  readonly receipts: Readonly<Record<string, PlaybookRepositoryReceipt>>;
+  readonly effectLedger: PlaybookEffectLedger;
+}
+
 export interface XStateRepositoryCapability {
   runExclusive<T>(options: {
     readonly signal: AbortSignal;
@@ -482,6 +577,34 @@ export interface XStateRepositoryCapability {
     readonly signal: AbortSignal;
     readonly operationId: string;
   }): Promise<XStateRepositoryDeferredParked | XStateRepositoryDeferredRestoreResult>;
+  /**
+   * DR-067 §1 / PBRT-73: one repository claim over the working leaves of a
+   * parallel state entered together — every member an `unchanged` boundary
+   * of one cohort, the operations run concurrently under that claim, and
+   * one completion callback per member. Required for an artifact that
+   * declares a parallel state.
+   */
+  runCohort?<T>(options: {
+    readonly signal: AbortSignal;
+    readonly invocationId: string;
+    readonly roleIds: readonly string[];
+    readonly dispositionsByRole: Readonly<Record<string, readonly ['unchanged']>>;
+    readonly effectBoundaries: Readonly<Record<string, XStateEffectBoundarySeed>>;
+    readonly operations: Readonly<
+      Record<
+        string,
+        (context: {
+          readonly baseline: PlaybookRepositoryReceipt['baseline'];
+          readonly identity: unknown;
+          readonly invocationId: string;
+          readonly roleId: string;
+        }) => Promise<T>
+      >
+    >;
+    readonly completeEffectBoundary: (
+      completion: XStateRepositoryCohortCompletion<T>,
+    ) => XStateRepositoryCompletionEvidence | Promise<XStateRepositoryCompletionEvidence>;
+  }): Promise<XStateRepositoryCohortResult<T>>;
 }
 
 function assertNoConfiguredHostCapabilities(value: unknown, label: string): void {
@@ -583,6 +706,7 @@ function configuredOptionsFromFactoryInput(
 function repositoryCapabilityFromHostCapabilities(
   hostCapabilities: object | undefined,
   label: string,
+  requireCohort = false,
 ): XStateRepositoryCapability {
   const descriptor =
     hostCapabilities === undefined
@@ -599,10 +723,15 @@ function repositoryCapabilityFromHostCapabilities(
     Array.isArray(repository) ||
     typeof (repository as { runExclusive?: unknown }).runExclusive !==
       'function' ||
-    typeof (repository as { runDeferred?: unknown }).runDeferred !== 'function'
+    typeof (repository as { runDeferred?: unknown }).runDeferred !==
+      'function' ||
+    (requireCohort &&
+      typeof (repository as { runCohort?: unknown }).runCohort !== 'function')
   ) {
     throw new TypeError(
-      `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`,
+      requireCohort
+        ? `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive, runCohort, and runDeferred`
+        : `${label} schema-3 factory input hostCapabilities.repository must be an own data property exposing runExclusive and runDeferred`,
     );
   }
   return repository as XStateRepositoryCapability;
@@ -1058,7 +1187,7 @@ export function normalizeErrorFull(
 // slc/link.md §Abort: cancellation is causal identity with the applicable
 // signal's reason — never an `AbortError` name, never bare signal state. A
 // distinct failure observed while the signal is aborted stays a non-abort
-// control error and takes precedence (mirrors DECIDE's bespoke reference).
+// control error and takes precedence.
 function isAbortFailure(error: unknown, signal: AbortSignal): boolean {
   return signal.aborted && Object.is(error, signal.reason);
 }
@@ -1109,7 +1238,38 @@ function pendingBossQuestionForState(
 export function pendingBossQuestionFromContext(
   context: Record<string, unknown>,
 ): PlaybookPendingBossQuestionContext | undefined {
-  const pending = context.pendingBossQuestion;
+  return pendingBossQuestionRecord(context.pendingBossQuestion);
+}
+
+/**
+ * DR-067 §1: the keyed form of gears2fsm's Boss-reply suspension. Each
+ * well-formed `context.pendingBossQuestions[stateId]` record whose own
+ * `questionId` equals its key counts only while a wait state that resumes
+ * its `resumeStateId` is active, so an answered question the context
+ * retains for the resumed prompt never reads as pending. Ordered by
+ * question id.
+ */
+function keyedPendingBossQuestions(
+  context: Record<string, unknown>,
+  resumesFromActiveWait: (resumeStateId: string) => boolean,
+): PlaybookPendingBossQuestionContext[] {
+  const keyed = context.pendingBossQuestions;
+  if (!isPlainObject(keyed)) return [];
+  const pending: PlaybookPendingBossQuestionContext[] = [];
+  for (const [key, value] of Object.entries(keyed)) {
+    const record = pendingBossQuestionRecord(value);
+    if (record === undefined || record.questionId !== key) continue;
+    if (!resumesFromActiveWait(record.resumeStateId)) continue;
+    pending.push(record);
+  }
+  return pending.sort((left, right) =>
+    left.questionId.localeCompare(right.questionId),
+  );
+}
+
+function pendingBossQuestionRecord(
+  pending: unknown,
+): PlaybookPendingBossQuestionContext | undefined {
   if (
     pending === undefined ||
     pending === null ||
@@ -1269,8 +1429,8 @@ function preExistingChangesBlock(
  * `one-descendant-commit` disposition may commit nothing, so it is told
  * nothing.
  */
-function effectAuthorizedPreExistingBlock(
-  effectBoundary: Pick<XStateEffectBoundarySeed, 'dispositions'>,
+export function effectAuthorizedPreExistingBlock(
+  effectBoundary: Pick<PlaybookEffectBoundaryStart, 'dispositions'>,
   baseline: PlaybookRepositoryReceipt['baseline'] | undefined,
 ): string | undefined {
   return effectBoundary.dispositions.includes('one-descendant-commit')
@@ -1587,8 +1747,8 @@ export function defaultBuildJudgePrompt(
  * so the judge omits it. Rendering the clause verbatim asked the judge for
  * `question`, `planningResult`, or `evaluatedRevision`, which the reconciler
  * rejects as a structural error, spending the single correction on a
- * self-inflicted defect. Exported so a bespoke linked runtime (DECIDE's
- * parallel machinery) renders the identical contract instead of restating it.
+ * self-inflicted defect. Exported so linked machinery of an artifact's own
+ * renders the identical contract instead of restating it.
  */
 export function renderGovernedOutcomeContract(
   guard: string,
@@ -1883,7 +2043,7 @@ export function createPlayerBridge(
         const failure = new Error(
           result.error ?? `captainBridge: callPlayer status "${result.status}"`,
         );
-        throw boundary?.markPlayerResultFailure?.(failure) ?? failure;
+        throw boundary?.markPlayerResultFailure?.(failure, result) ?? failure;
       }
       const finalText = result.finalText ?? '';
       if (isEmptyFinalText(finalText)) {
@@ -2110,7 +2270,81 @@ function transitionTargets(transition: unknown): string[] {
   return targets;
 }
 
-/** Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions. */
+function transitionArmTargets(transition: unknown): string[] {
+  const arms = Array.isArray(transition) ? transition : [transition];
+  const targets: string[] = [];
+  for (const arm of arms) {
+    if (typeof arm === 'string') {
+      targets.push(arm);
+    } else if (isPlainObject(arm) && typeof arm.target === 'string') {
+      targets.push(arm.target);
+    }
+  }
+  return targets;
+}
+
+function playbookStateIdOf(stateDef: unknown): string | undefined {
+  if (!isPlainObject(stateDef) || !isPlainObject(stateDef.meta)) {
+    return undefined;
+  }
+  const playbook = stateDef.meta.playbook;
+  return isPlainObject(playbook) && typeof playbook.stateId === 'string'
+    ? playbook.stateId
+    : undefined;
+}
+
+function stateTagsOf(stateDef: Record<string, unknown>): readonly string[] {
+  const tags = stateDef.tags;
+  if (typeof tags === 'string') return [tags];
+  return Array.isArray(tags)
+    ? tags.filter((tag): tag is string => typeof tag === 'string')
+    : [];
+}
+
+/** Every explicit node `id` in the config, mapped to its playbook state id. */
+function playbookStateIdsByNodeId(config: unknown): ReadonlyMap<string, string> {
+  const byNodeId = new Map<string, string>();
+  const visit = (stateDef: unknown): void => {
+    if (!isPlainObject(stateDef)) return;
+    const stateId = playbookStateIdOf(stateDef);
+    if (typeof stateDef.id === 'string' && stateId !== undefined) {
+      byNodeId.set(stateDef.id, stateId);
+    }
+    if (isPlainObject(stateDef.states)) {
+      for (const child of Object.values(stateDef.states)) visit(child);
+    }
+  };
+  if (isPlainObject(config) && isPlainObject(config.states)) {
+    for (const child of Object.values(config.states)) visit(child);
+  }
+  return byNodeId;
+}
+
+/**
+ * One transition target written inside a parallel region, resolved to the
+ * playbook state id it names: an `#id` reference through the node ids, and a
+ * bare sibling key through the region's own leaves.
+ */
+function resolveRegionTarget(
+  target: string,
+  regionStates: Record<string, unknown>,
+  byNodeId: ReadonlyMap<string, string>,
+): string {
+  if (target.startsWith('#')) {
+    const nodeId = target.slice(1);
+    return byNodeId.get(nodeId) ?? nodeId;
+  }
+  if (Object.prototype.hasOwnProperty.call(regionStates, target)) {
+    return playbookStateIdOf(regionStates[target]) ?? target;
+  }
+  return target;
+}
+
+/**
+ * Targets of the FSM's `awaitBossReply` BOSS_REPLY transitions, plus — for
+ * the parallel shape gears2fsm compiles (DR-067) — the targets of each
+ * region wait leaf's branch-local BOSS_REPLY arms, resolved to state ids.
+ */
 export function resumableStateIdsFromMachine(
   machine: AnyStateMachine,
 ): ReadonlySet<string> {
@@ -2118,13 +2352,321 @@ export function resumableStateIdsFromMachine(
   if (!isPlainObject(config) || !isPlainObject(config.states)) {
     return new Set();
   }
+  const resumable = new Set<string>();
   const awaitState = config.states[BOSS_REPLY_WAIT_STATE_ID];
-  if (!isPlainObject(awaitState) || !isPlainObject(awaitState.on)) {
-    return new Set();
+  if (isPlainObject(awaitState) && isPlainObject(awaitState.on)) {
+    const bossReply = awaitState.on.BOSS_REPLY;
+    if (bossReply !== undefined) {
+      for (const target of transitionTargets(bossReply)) resumable.add(target);
+    }
+  }
+  const byNodeId = playbookStateIdsByNodeId(config);
+  for (const stateDef of Object.values(config.states)) {
+    if (
+      !isPlainObject(stateDef) ||
+      stateDef.type !== 'parallel' ||
+      !isPlainObject(stateDef.states)
+    ) {
+      continue;
+    }
+    for (const region of Object.values(stateDef.states)) {
+      if (!isPlainObject(region) || !isPlainObject(region.states)) continue;
+      const regionStates = region.states;
+      for (const leaf of Object.values(regionStates)) {
+        if (!isPlainObject(leaf) || !isPlainObject(leaf.on)) continue;
+        const bossReply = leaf.on.BOSS_REPLY;
+        if (bossReply === undefined) continue;
+        for (const target of transitionArmTargets(bossReply)) {
+          resumable.add(resolveRegionTarget(target, regionStates, byNodeId));
+        }
+      }
+    }
+  }
+  return resumable;
+}
+
+/** One region of a compiled parallel state (DR-067 §1). */
+interface XStateParallelRegion {
+  readonly key: string;
+  readonly roleId: string;
+  readonly workingStateId: string;
+  readonly waitStateId: string;
+  readonly finalStateId: string;
+}
+
+/** One root `type: 'parallel'` state of the compiled shape. */
+interface XStateParallelState {
+  readonly stateId: string;
+  readonly regions: readonly XStateParallelRegion[];
+}
+
+/**
+ * The parallel profile derived from a machine that declares a parallel
+ * state (DR-067 §1): its parallel states, each wait state's resume targets
+ * — region waits and the root reply wait alike — and, per state id, the
+ * config nodes whose `on` maps an active state contributes.
+ */
+interface XStateParallelProfile {
+  readonly states: readonly XStateParallelState[];
+  readonly parallelStateByWorkingStateId: ReadonlyMap<
+    string,
+    XStateParallelState
+  >;
+  readonly waitResumeTargets: ReadonlyMap<string, ReadonlySet<string>>;
+  readonly transitionNodesByStateId: ReadonlyMap<
+    string,
+    readonly Record<string, unknown>[]
+  >;
+}
+
+/** One registered cohort member awaiting its cohort's settlement. */
+interface XStateCohortMember {
+  readonly region: XStateParallelRegion;
+  readonly input: PlaybookPlayerInput;
+  readonly roleId: string;
+  readonly playerId: string | undefined;
+  readonly playerKey: string;
+  readonly signal: AbortSignal;
+  readonly effectBoundary: XStateEffectBoundarySeed;
+  readonly run: (
+    callSignal: AbortSignal,
+    cohortCancellation: AbortSignal,
+    preExistingBlock: string | undefined,
+  ) => Promise<PlayerResult>;
+  readonly reportCollision: (callSignal: AbortSignal) => Promise<never>;
+  readonly settled: DeferredValue<PlayerResult>;
+}
+
+/** The cohort of one parallel state within one public boundary. */
+interface PendingCohort {
+  readonly boundarySequence: number;
+  readonly members: Map<string, XStateCohortMember>;
+  started: boolean;
+}
+
+function malformedParallelState(
+  label: string,
+  key: string,
+  reason: string,
+): Error {
+  return new Error(
+    `${label} parallel state ${key} is not the compiled parallel shape: ${reason}`,
+  );
+}
+
+/**
+ * DR-067 §1 / PBRT-52: the factory's domain is flat root states plus root
+ * `type: 'parallel'` states of the one shape gears2fsm compiles — each
+ * region a compound state with exactly one player-invoking `playbook.busy`
+ * working leaf, exactly one `playbook.parked` wait leaf whose BOSS_REPLY
+ * arms resume that working leaf, and exactly one final leaf, every leaf
+ * carrying a stable `meta.playbook.stateId` distinct from every other
+ * state's, and the parent's `onDone` the join. Any other compound state
+ * keeps the flat-domain rejection. Returns `undefined` for a flat machine.
+ */
+function parallelProfileFromMachine(
+  machine: AnyStateMachine,
+  label: string,
+): XStateParallelProfile | undefined {
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config) || !isPlainObject(config.states)) {
+    return undefined;
+  }
+  const rootStates = config.states;
+  const parallelKeys = Object.entries(rootStates)
+    .filter(
+      ([, stateDef]) => isPlainObject(stateDef) && stateDef.type === 'parallel',
+    )
+    .map(([key]) => key);
+  for (const stateDef of Object.values(rootStates)) {
+    if (
+      isPlainObject(stateDef) &&
+      stateDef.type !== 'parallel' &&
+      isPlainObject(stateDef.states) &&
+      Object.keys(stateDef.states).length > 0
+    ) {
+      throw new Error(
+        `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
+      );
+    }
+  }
+  if (parallelKeys.length === 0) return undefined;
+
+  const byNodeId = playbookStateIdsByNodeId(config);
+  const seenStateIds = new Set<string>();
+  for (const stateDef of Object.values(rootStates)) {
+    const stateId = playbookStateIdOf(stateDef);
+    if (stateId !== undefined) seenStateIds.add(stateId);
+  }
+  const states: XStateParallelState[] = [];
+  const parallelStateByWorkingStateId = new Map<string, XStateParallelState>();
+  const waitResumeTargets = new Map<string, ReadonlySet<string>>();
+  const transitionNodesByStateId = new Map<
+    string,
+    readonly Record<string, unknown>[]
+  >();
+  for (const key of parallelKeys) {
+    const parent = rootStates[key] as Record<string, unknown>;
+    if (parent.onDone === undefined) {
+      throw malformedParallelState(label, key, 'it declares no onDone join');
+    }
+    if (!isPlainObject(parent.states) || Object.keys(parent.states).length < 2) {
+      throw malformedParallelState(
+        label,
+        key,
+        'it must declare at least two regions',
+      );
+    }
+    const regions: XStateParallelRegion[] = [];
+    const roleIds = new Set<string>();
+    for (const [regionKey, region] of Object.entries(parent.states)) {
+      const regionReason = (reason: string) =>
+        malformedParallelState(label, key, `region ${regionKey} ${reason}`);
+      if (
+        !isPlainObject(region) ||
+        region.type === 'parallel' ||
+        region.type === 'final' ||
+        region.type === 'history' ||
+        !isPlainObject(region.states)
+      ) {
+        throw regionReason('must be a compound state of leaves');
+      }
+      const regionStates = region.states;
+      let working: [string, Record<string, unknown>] | undefined;
+      let wait: [string, Record<string, unknown>] | undefined;
+      let final: [string, Record<string, unknown>] | undefined;
+      for (const [leafKey, leaf] of Object.entries(regionStates)) {
+        if (!isPlainObject(leaf)) {
+          throw regionReason(`leaf ${leafKey} must be a state object`);
+        }
+        if (
+          (isPlainObject(leaf.states) && Object.keys(leaf.states).length > 0) ||
+          leaf.type === 'parallel' ||
+          leaf.type === 'history'
+        ) {
+          throw regionReason(`leaf ${leafKey} must be an atomic state`);
+        }
+        const leafStateId = playbookStateIdOf(leaf);
+        if (leafStateId === undefined || leafStateId.trim().length === 0) {
+          throw regionReason(
+            `leaf ${leafKey} must carry a string meta.playbook.stateId`,
+          );
+        }
+        if (seenStateIds.has(leafStateId)) {
+          throw regionReason(
+            `leaf ${leafKey} reuses playbook state id ${leafStateId}`,
+          );
+        }
+        seenStateIds.add(leafStateId);
+        const invoke = leaf.invoke;
+        const invokes = Array.isArray(invoke) ? invoke : invoke ? [invoke] : [];
+        const tags = stateTagsOf(leaf);
+        if (leaf.type === 'final') {
+          if (final !== undefined) throw regionReason('declares two final leaves');
+          final = [leafKey, leaf];
+        } else if (
+          invokes.length === 1 &&
+          isPlainObject(invokes[0]) &&
+          invokes[0].src === 'player' &&
+          tags.includes('playbook.busy')
+        ) {
+          if (working !== undefined) {
+            throw regionReason('declares two working leaves');
+          }
+          working = [leafKey, leaf];
+        } else if (
+          invokes.length === 0 &&
+          tags.includes('playbook.parked') &&
+          isPlainObject(leaf.on) &&
+          leaf.on.BOSS_REPLY !== undefined
+        ) {
+          if (wait !== undefined) throw regionReason('declares two wait leaves');
+          wait = [leafKey, leaf];
+        } else {
+          throw regionReason(
+            `leaf ${leafKey} is neither its player-invoking playbook.busy working leaf, its playbook.parked BOSS_REPLY wait leaf, nor its final leaf`,
+          );
+        }
+      }
+      if (working === undefined || wait === undefined || final === undefined) {
+        throw regionReason(
+          'must hold exactly one working leaf, one wait leaf, and one final leaf',
+        );
+      }
+      if (region.initial !== working[0]) {
+        throw regionReason('must start in its working leaf');
+      }
+      const workingStateId = playbookStateIdOf(working[1])!;
+      const waitStateId = playbookStateIdOf(wait[1])!;
+      const finalStateId = playbookStateIdOf(final[1])!;
+      const replyTargets = transitionArmTargets(
+        (wait[1].on as Record<string, unknown>).BOSS_REPLY,
+      ).map((target) => resolveRegionTarget(target, regionStates, byNodeId));
+      const regionStateIds = new Set([waitStateId, finalStateId]);
+      if (
+        !replyTargets.includes(workingStateId) ||
+        replyTargets.some((target) => regionStateIds.has(target))
+      ) {
+        throw regionReason(
+          'wait leaf BOSS_REPLY arms must resume its working leaf',
+        );
+      }
+      const workingMeta = (working[1].meta as Record<string, unknown>)
+        .playbook as Record<string, unknown>;
+      const roleId = workingMeta.role;
+      if (typeof roleId !== 'string' || roleId.trim().length === 0) {
+        throw regionReason('working leaf must declare meta.playbook.role');
+      }
+      if (roleIds.has(roleId)) {
+        throw malformedParallelState(
+          label,
+          key,
+          `role ${roleId} works in more than one region`,
+        );
+      }
+      roleIds.add(roleId);
+      regions.push({
+        key: regionKey,
+        roleId,
+        workingStateId,
+        waitStateId,
+        finalStateId,
+      });
+      waitResumeTargets.set(waitStateId, new Set([workingStateId]));
+      for (const [, leaf] of [working, wait, final]) {
+        transitionNodesByStateId.set(playbookStateIdOf(leaf)!, [region, leaf]);
+      }
+    }
+    const parallelState: XStateParallelState = {
+      stateId: key,
+      regions: Object.freeze(regions),
+    };
+    states.push(parallelState);
+    for (const region of regions) {
+      parallelStateByWorkingStateId.set(region.workingStateId, parallelState);
+    }
+    transitionNodesByStateId.set(key, [parent]);
+  }
+  for (const [key, stateDef] of Object.entries(rootStates)) {
+    if (!isPlainObject(stateDef) || parallelKeys.includes(key)) continue;
+    transitionNodesByStateId.set(key, [stateDef]);
   }
-  const bossReply = awaitState.on.BOSS_REPLY;
-  if (bossReply === undefined) return new Set();
-  return new Set(transitionTargets(bossReply));
+  const rootWait = rootStates[BOSS_REPLY_WAIT_STATE_ID];
+  if (isPlainObject(rootWait) && isPlainObject(rootWait.on)) {
+    const bossReply = rootWait.on.BOSS_REPLY;
+    if (bossReply !== undefined) {
+      waitResumeTargets.set(
+        BOSS_REPLY_WAIT_STATE_ID,
+        new Set(transitionTargets(bossReply)),
+      );
+    }
+  }
+  return Object.freeze({
+    states: Object.freeze(states),
+    parallelStateByWorkingStateId,
+    waitResumeTargets,
+    transitionNodesByStateId,
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -2937,10 +3479,63 @@ function eventContractPrompt(contract: XStateBossEventSpec): string {
   }`;
 }
 
+/**
+ * DR-067 §1: the questions pending in a parallel-declaring machine — the
+ * keyed records whose resume state an active wait state (a region wait leaf
+ * or the root reply wait) resumes.
+ */
+function parallelPendingBossQuestions(
+  profile: XStateParallelProfile,
+  activeStateIds: readonly string[],
+  context: Record<string, unknown>,
+): PlaybookPendingBossQuestionContext[] {
+  return keyedPendingBossQuestions(context, (resumeStateId) =>
+    activeStateIds.some(
+      (stateId) =>
+        profile.waitResumeTargets.get(stateId)?.has(resumeStateId) === true,
+    ),
+  );
+}
+
+/** Event types the root and every active state node of a parallel machine configure. */
+function parallelConfiguredEventTypes(
+  machine: AnyStateMachine,
+  profile: XStateParallelProfile,
+  activeStateIds: readonly string[],
+): ReadonlySet<string> {
+  const configured = new Set<string>();
+  const config = (machine as unknown as { config?: unknown }).config;
+  if (!isPlainObject(config)) return configured;
+  if (isPlainObject(config.on)) {
+    for (const type of Object.keys(config.on)) configured.add(type);
+  }
+  for (const stateId of activeStateIds) {
+    for (const node of profile.transitionNodesByStateId.get(stateId) ?? []) {
+      if (!isPlainObject(node.on)) continue;
+      for (const type of Object.keys(node.on)) configured.add(type);
+    }
+  }
+  return configured;
+}
+
+function activeStateIdsOf(snapshotOrState: unknown): readonly string[] {
+  const listed = (snapshotOrState as { activeStateIds?: unknown } | null)
+    ?.activeStateIds;
+  if (Array.isArray(listed)) {
+    return listed.filter((stateId): stateId is string => typeof stateId === 'string');
+  }
+  try {
+    return normalizePlaybookSnapshot(snapshotOrState).activeStateIds;
+  } catch {
+    return [];
+  }
+}
+
 function makeDefaultClassifyBossText(
   machine: AnyStateMachine,
   entryEvent: { type: string; textField: string } | undefined,
   bossEvents: readonly XStateBossEventSpec[],
+  parallelProfile?: XStateParallelProfile,
 ): (
   text: string,
   ports: PlaybookPorts,
@@ -2960,16 +3555,54 @@ function makeDefaultClassifyBossText(
     // is answered history, so the prompt must not present it as pending —
     // a judge told a question awaits at the failure state is steered toward
     // a reply it cannot select or toward no action at all.
-    const pending =
-      stateId === BOSS_REPLY_WAIT_STATE_ID
-        ? pendingBossQuestionFromContext(state.context)
-        : undefined;
-    const configuredTypes = configuredEventTypesForState(machine, stateId);
-    const applicable = [...contracts.values()].filter(
-      (contract) =>
-        configuredTypes.has(contract.type) &&
-        (contract.type !== 'BOSS_REPLY' || pending !== undefined),
-    );
+    let pendingQuestions: readonly PlaybookPendingBossQuestionContext[];
+    let configuredTypes: ReadonlySet<string>;
+    if (parallelProfile === undefined) {
+      const pending =
+        stateId === BOSS_REPLY_WAIT_STATE_ID
+          ? pendingBossQuestionFromContext(state.context)
+          : undefined;
+      pendingQuestions = pending === undefined ? [] : [pending];
+      configuredTypes = configuredEventTypesForState(machine, stateId);
+    } else {
+      // DR-067 §1: every question pending in any active wait is offered, and
+      // the events of every active state node apply.
+      const activeStateIds = activeStateIdsOf(snapshotOrState);
+      pendingQuestions = parallelPendingBossQuestions(
+        parallelProfile,
+        activeStateIds,
+        state.context,
+      );
+      configuredTypes = parallelConfiguredEventTypes(
+        machine,
+        parallelProfile,
+        activeStateIds,
+      );
+    }
+    // Several pending questions: a reply must name the one it answers, and
+    // the classifier never guesses among them (gears2fsm §Parallel groups).
+    const severalPending = pendingQuestions.length > 1;
+    const applicable = [...contracts.values()]
+      .filter(
+        (contract) =>
+          configuredTypes.has(contract.type) &&
+          (contract.type !== 'BOSS_REPLY' || pendingQuestions.length > 0),
+      )
+      .map((contract): XStateBossEventSpec =>
+        contract.type === 'BOSS_REPLY' && severalPending
+          ? {
+              type: 'BOSS_REPLY',
+              fields: {
+                questionId: {
+                  source: 'judge',
+                  required: true,
+                  values: pendingQuestions.map(({ questionId }) => questionId),
+                },
+                answer: { source: 'text', required: true },
+              },
+            }
+          : contract,
+      );
 
     const lines = [
       'Classify the following Boss message into exactly one event.',
@@ -2978,13 +3611,18 @@ function makeDefaultClassifyBossText(
       '',
       `Current state: ${currentState}`,
     ];
-    if (pending !== undefined) {
+    for (const pending of pendingQuestions) {
       lines.push(
         `Pending question id: ${pending.questionId}`,
         `Pending asker: ${askerLabel(pending.asker)}`,
         `Pending Boss question: ${pending.question}`,
       );
     }
+    if (severalPending) {
+      lines.push(
+        'Several Boss questions are pending: a BOSS_REPLY must name the questionId of the one question it answers.',
+      );
+    }
     lines.push('', 'Allowed JSON objects:', '- { "type": "NO_ACTION" }');
     for (const contract of applicable) {
       lines.push(`- ${eventContractPrompt(contract)}`);
@@ -3077,20 +3715,23 @@ function makeDefaultClassifyBossText(
     }
 
     if (eventType === 'BOSS_REPLY') {
-      if (pending === undefined) {
+      if (pendingQuestions.length === 0) {
         await ports.emitStatus(
           'Classifier returned BOSS_REPLY without a pending question',
         );
         return undefined;
       }
-      const questionId = event.questionId;
-      if (questionId !== undefined && questionId !== pending.questionId) {
-        await ports.emitStatus(
-          `Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`,
-        );
-        return undefined;
+      if (!severalPending) {
+        const pending = pendingQuestions[0]!;
+        const questionId = event.questionId;
+        if (questionId !== undefined && questionId !== pending.questionId) {
+          await ports.emitStatus(
+            `Classifier supplied unknown questionId for BOSS_REPLY: ${String(questionId)}`,
+          );
+          return undefined;
+        }
+        event.questionId = pending.questionId;
       }
-      event.questionId = pending.questionId;
     }
     const can = (snapshotOrState as { can?: unknown } | null)?.can;
     if (
@@ -3127,34 +3768,6 @@ interface TracePosition {
   callId?: string;
 }
 
-function machineDeclaresParallelState(machine: AnyStateMachine): boolean {
-  const visit = (stateDef: unknown): boolean => {
-    if (!isPlainObject(stateDef)) return false;
-    if (stateDef.type === 'parallel') return true;
-    if (!isPlainObject(stateDef.states)) return false;
-    return Object.values(stateDef.states).some(visit);
-  };
-  return visit((machine as unknown as { config?: unknown }).config);
-}
-
-// PBRT-52: the factory's domain is FLAT single-region machines — every
-// state a direct child of the root, so each snapshot exposes exactly one
-// playbook state id and every state-keyed lookup (deterministic entries,
-// retry, reply-wait pendingness, configured events, descriptions) indexes
-// one unambiguous identity. A compound child would be accepted and then
-// silently misbehave on all of those gates, so it is rejected up front
-// exactly like a parallel region.
-function machineDeclaresNestedState(machine: AnyStateMachine): boolean {
-  const config = (machine as unknown as { config?: unknown }).config;
-  if (!isPlainObject(config) || !isPlainObject(config.states)) return false;
-  return Object.values(config.states).some(
-    (stateDef) =>
-      isPlainObject(stateDef) &&
-      isPlainObject(stateDef.states) &&
-      Object.keys(stateDef.states).length > 0,
-  );
-}
-
 // PBRT-52: the factory's lookups index states by their root key, and the
 // published playbook identity is `meta.playbook.stateId` — the two must
 // coincide or a machine can advertise a pending question or retry under an
@@ -3249,10 +3862,12 @@ function assertUnfinishedFinalStateIds(
  * the optional parked-session snapshot capability (DR-014) and the retained-
  * snapshot adoption capability (DR-038).
  *
- * Scope: flat single-region machines — no parallel state, no compound
- * child states, and every root state's `meta.playbook.stateId` equal to its
- * state key — so each snapshot exposes exactly one playbook state id.
- * Parallel-region FSMs keep their own linked runtimes.
+ * Scope: flat single-region machines — every root state's
+ * `meta.playbook.stateId` equal to its state key, so each snapshot exposes
+ * exactly one playbook state id — plus the parallel profile of DR-067: root
+ * `type: 'parallel'` states of the shape gears2fsm compiles, whose regions
+ * run as one all-`unchanged` repository cohort with keyed pending questions.
+ * A machine declaring a parallel state omits `adopt`.
  */
 export function createXStatePlaybookRuntime<
   TOptions,
@@ -3288,16 +3903,9 @@ export function createXStatePlaybookRuntime<
       `${label} artifacts must not derive concrete player bindings`,
     );
   }
-  if (machineDeclaresParallelState(machine)) {
-    throw new Error(
-      `${label} uses a parallel state; the shared runtime supports only single-region FSMs`,
-    );
-  }
-  if (machineDeclaresNestedState(machine)) {
-    throw new Error(
-      `${label} declares a compound state; the shared runtime supports only flat single-region FSMs`,
-    );
-  }
+  // DR-067 §1: a flat machine, or one whose only compound states are root
+  // parallel states of the compiled shape; everything else is rejected.
+  const parallelProfile = parallelProfileFromMachine(machine, label);
   assertFlatStateIdentity(machine, label);
   assertUnfinishedFinalStateIds(
     spec.unfinishedFinalStateIds,
@@ -3338,6 +3946,18 @@ export function createXStatePlaybookRuntime<
   const declaredRoleIds = Object.freeze([
     ...new Set([...roleStates.values()].map(({ role }) => role)),
   ]);
+  // DR-067 §1: the Boss-relevant states of a parallel-declaring machine —
+  // each player state, each wait state, and the failure state. A status is
+  // scheduled for each one newly entered, and a status trace names a
+  // `stateId` only while exactly one is active.
+  const bossRelevantStateIds: ReadonlySet<string> | undefined =
+    parallelProfile === undefined
+      ? undefined
+      : new Set([
+          ...roleStates.keys(),
+          ...parallelProfile.waitResumeTargets.keys(),
+          'failed',
+        ]);
   // PBRT-52: the artifact's own ControlView context projection. Nothing is
   // exported by default, so an FSM context member — including one added
   // after this artifact was linked — is private until named here. The two
@@ -3402,6 +4022,7 @@ export function createXStatePlaybookRuntime<
     machine,
     spec.entryEvent,
     spec.bossEvents ?? [],
+    parallelProfile,
   );
   const classifyBossText: NonNullable<
     XStatePlaybookRuntimeSpec<TOptions>['classifyBossText']
@@ -3425,8 +4046,126 @@ export function createXStatePlaybookRuntime<
       return typeof cwd === 'string' ? cwd : undefined;
     });
 
-  const createPlaybookRuntime = function createPlaybookRuntime(
-    factoryOptions: unknown,
+  // DR-067 §1: the questions pending in a state — the singular reply-wait
+  // question of a flat machine, or a parallel machine's keyed questions
+  // whose own wait state is active.
+  const pendingBossQuestionsFor = (
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): readonly PlaybookPendingBossQuestionContext[] => {
+    if (parallelProfile === undefined) {
+      const pending = pendingBossQuestionForState(state, context);
+      return pending === undefined ? [] : [pending];
+    }
+    return parallelPendingBossQuestions(
+      parallelProfile,
+      state.activeStateIds,
+      context,
+    );
+  };
+  const singlePendingBossQuestion = (
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): PlaybookPendingBossQuestionContext | undefined => {
+    const pending = pendingBossQuestionsFor(state, context);
+    return pending.length === 1 ? pending[0] : undefined;
+  };
+  // DR-067 §1: a status trace names a `stateId` only while exactly one
+  // Boss-relevant state is active; a flat machine's is its one state.
+  const statusTraceStateId = (state: PlaybookState): string | undefined => {
+    if (bossRelevantStateIds === undefined) return state.stateId;
+    const relevant = state.activeStateIds.filter((stateId) =>
+      bossRelevantStateIds.has(stateId),
+    );
+    return relevant.length === 1 ? relevant[0] : undefined;
+  };
+  // DR-067 §1: a parallel machine schedules statuses for each newly entered
+  // Boss-relevant state — a player state's role line, a wait state's
+  // question lines, and the failure line — diffed against the previous
+  // snapshot's active state ids, so a sibling still running is not
+  // announced again.
+  const parallelStatusesFor = (
+    previousState: PlaybookState | undefined,
+    state: PlaybookState,
+    context: Record<string, unknown>,
+  ): ScheduledStatus[] => {
+    const prior = new Set(previousState?.activeStateIds ?? []);
+    const statuses: ScheduledStatus[] = [];
+    for (const stateId of state.activeStateIds) {
+      if (prior.has(stateId) || !bossRelevantStateIds!.has(stateId)) continue;
+      const resumeTargets = parallelProfile!.waitResumeTargets.get(stateId);
+      if (resumeTargets !== undefined) {
+        const questions = keyedPendingBossQuestions(context, (resumeStateId) =>
+          resumeTargets.has(resumeStateId),
+        );
+        if (questions.length === 0) {
+          statuses.push({ message: 'Awaiting Boss reply.' });
+          continue;
+        }
+        for (const pending of questions) {
+          statuses.push(
+            {
+              message: `${askerLabel(pending.asker)} asks: ${pending.question}`,
+            },
+            {
+              message:
+                `◆ awaiting Boss reply · ${pending.resumeStateId} · ` +
+                `${askerLabel(pending.asker)} · ${pending.sourceItem}`,
+            },
+          );
+        }
+        continue;
+      }
+      if (stateId === 'failed') {
+        const lastError = normalizeErrorCompact(context.lastError);
+        statuses.push({
+          message: '◆ workflow failed; awaiting Boss recovery.',
+          ...(lastError === undefined
+            ? {}
+            : {
+                data: snapshotJsonValue({ lastError }, 'failed status data'),
+              }),
+        });
+        continue;
+      }
+      const roleState = roleStates.get(stateId);
+      if (roleState !== undefined) {
+        statuses.push({ message: `⤷ ${roleState.role}: ${roleState.label}` });
+      }
+    }
+    return statuses;
+  };
+  // DR-067 §1: each parallel state's region roles, in region order, are one
+  // concurrent role set the FSM exports; a host that forwards those sets in
+  // its schema-3 authority is held to them before any agent call.
+  const assertDeclaredCohorts = (hostCapabilities: object): void => {
+    const authority = Object.getOwnPropertyDescriptor(
+      hostCapabilities,
+      'authority',
+    )?.value;
+    if (!isPlainObject(authority) || !Array.isArray(authority.concurrentRoleSets)) {
+      return;
+    }
+    const declared = authority.concurrentRoleSets as readonly unknown[];
+    for (const parallelState of parallelProfile!.states) {
+      const roles = parallelState.regions.map(({ roleId }) => roleId);
+      if (
+        !declared.some(
+          (candidate) =>
+            Array.isArray(candidate) &&
+            candidate.length === roles.length &&
+            candidate.every((roleId, index) => roleId === roles[index]),
+        )
+      ) {
+        throw new TypeError(
+          `${label} parallel state ${parallelState.stateId} roles [${roles.join(', ')}] are not a declared concurrent role set`,
+        );
+      }
+    }
+  };
+
+  const createPlaybookRuntime = function createPlaybookRuntime(
+    factoryOptions: unknown,
   ): PlaybookRuntime {
     const construction = configuredOptionsFromFactoryInput(
       factoryOptions,
@@ -3459,8 +4198,12 @@ export function createXStatePlaybookRuntime<
         ? repositoryCapabilityFromHostCapabilities(
             construction.hostCapabilities,
             label,
+            parallelProfile !== undefined,
           )
         : undefined;
+    if (parallelProfile !== undefined) {
+      assertDeclaredCohorts(construction.hostCapabilities);
+    }
     const currentEffectLedger = (): PlaybookEffectLedger =>
       assertPlaybookEffectLedger(
         effectLedgerCapability.snapshot(),
@@ -3531,9 +4274,11 @@ export function createXStatePlaybookRuntime<
     // mutable `activeSignal` alone cannot classify a late invocation reason.
     let activeAborts: AbortReasonClassifier | undefined;
     // The bridge binds the provenance of a child result immediately before
-    // its promise actor settles. The next root snapshot/error consumes this
-    // one-shot so background settlement emissions retain their owner.
-    let actorSettlementAborts: AbortReasonClassifier | undefined;
+    // its promise actor settles. The next root snapshot/error consumes it so
+    // background settlement emissions retain their owner. A flat machine has
+    // one settling actor at a time, so a later binding replaces an unconsumed
+    // one; a parallel machine's settlements queue in order (DR-067 §1).
+    const actorSettlementAborts: (AbortReasonClassifier | undefined)[] = [];
     let actorSettlementErrorAborts: AbortReasonClassifier | undefined;
     // Exact cancellation observed by an emission owned by the active
     // boundary. Ordinary runs settle from their signal/state; apply also
@@ -3577,15 +4322,35 @@ export function createXStatePlaybookRuntime<
     let deferInspectionEmissions = false;
     let deferredInspectionEmissions: Array<() => void> = [];
     let controlPlaneError: unknown;
-    // DR-063 §2: the cause decided at the site the failure was decided, kept
-    // for the failures whose Error the compiled artifact builds itself and the
-    // runtime therefore cannot decorate. It is cleared at each Boss turn start
-    // and at each successful player result, so it is never stale, and it is
-    // only ever read as the cause of an error that carries none of its own.
-    let lastFailureCause: PlaybookFailureCause | undefined;
-    const rememberFailureCause = (cause: PlaybookFailureCause): void => {
-      lastFailureCause = cause;
-    };
+    // DR-063 §2: the cause decided for a non-`ok` player result before the
+    // compiled artifact builds the Error that carries it and hands it to
+    // `markPlayerResultFailure`. It is cleared at each Boss turn start and at
+    // each successful result, so it is never stale.
+    let pendingResultFailureCause: PlaybookFailureCause | undefined;
+    // DR-063 §2: the causes decided for thrown values that cannot carry the
+    // marker — a string, a frozen error — and for the record a machine keeps
+    // in place of the thrown value, kept by identity for as long as the
+    // failure stands, so every surface that reads the FSM's own `lastError`
+    // publishes the cause decided for exactly that failure, whatever turn
+    // reads it.
+    const failureCauses = createFailureCauseRetention();
+    // DR-063 §2 / DR-067 §1: the cause decided for each non-`ok` player
+    // result, keyed by the result itself, so concurrent region calls never
+    // lend one another the single slot above.
+    const resultFailureCauses = new WeakMap<object, PlaybookFailureCause>();
+    // DR-067 §1: the parallel profile's cohort bookkeeping. Every public
+    // boundary advances the sequence; a parallel state's working leaves run
+    // as one cohort at most once per boundary, and each cohort's semantic
+    // completions — which the host settles concurrently — reconcile one at a
+    // time so their durable correction-budget writes cannot race.
+    let publicBoundarySequence = 0;
+    const consumedCohortBoundaries = new Map<string, number>();
+    const pendingCohorts = new Map<string, PendingCohort>();
+    const cohortCompletionQueue = new PQueue({ concurrency: 1 });
+    // DR-067 §1: every player, judge, and nested call a parallel machine
+    // starts, so a boundary's drain waits for a cancelled sibling whose port
+    // ignores its signal before it settles.
+    const activeBoundaryCalls = new Set<Promise<unknown>>();
     // Previous root-machine state for the inspect-driven telemetry /
     // status emitter. undefined before the first inspect firing.
     let priorState: PlaybookState | undefined;
@@ -4654,7 +5419,7 @@ export function createXStatePlaybookRuntime<
               ...(descriptor !== undefined
                 ? {
                     state: descriptor,
-                    ...stateIdentity(descriptor.stateId),
+                    ...stateIdentity(statusTraceStateId(descriptor)),
                   }
                 : {}),
             },
@@ -4705,9 +5470,12 @@ export function createXStatePlaybookRuntime<
       // start-only fields, so it passes its own canonical pre-acceptance
       // base (slc/link.md §Playbook trace).
       finishIdentity: Record<string, unknown> = identity,
+      // DR-067 §1: the per-call abort classification a parallel machine's
+      // player pairs enqueue under; absent, the active boundary's.
+      aborts?: AbortReasonClassifier,
     ): Promise<void> {
       try {
-        await emitTrace(startedType, identity, position);
+        await emitTrace(startedType, identity, position, aborts);
       } catch (error) {
         if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
         try {
@@ -4719,6 +5487,7 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(error),
             },
             position,
+            aborts,
           );
         } catch {
           // Preserve the start failure after one best-effort finish attempt.
@@ -4865,30 +5634,6 @@ export function createXStatePlaybookRuntime<
       });
     }
 
-    // DR-063 §1: the cause of an unresolved governed settlement. A reconciled
-    // mismatch supplies its own receipt-read cause; the reasons this function
-    // owns map to adjudication, abort, and runtime-defect codes.
-    function governedSettlementCause(
-      reason: string,
-      error: unknown,
-      aborted: boolean,
-      supplied: PlaybookFailureCause | undefined,
-    ): PlaybookFailureCause {
-      if (supplied !== undefined) return supplied;
-      if (aborted || reason.includes('aborted')) return ABORTED_FAILURE_CAUSE;
-      if (GOVERNED_JUDGE_FAILURE_REASONS.includes(reason)) {
-        const transport = failureErrorEvidence(error);
-        return assertPlaybookFailureCause({
-          code: 'judge-failed',
-          evidence: {
-            reason,
-            ...(transport === undefined ? {} : { error: transport }),
-          },
-        });
-      }
-      return runtimeDefectCause(reason);
-    }
-
     function unresolvedGovernedSettlement(
       reason: string,
       error?: unknown,
@@ -4900,8 +5645,8 @@ export function createXStatePlaybookRuntime<
           ? Object.is(error, signal.reason)
           : false;
       const decided = governedSettlementCause(reason, error, aborted, cause);
-      rememberFailureCause(decided);
       if (aborted) {
+        failureCauses.retain(error, decided);
         return {
           status: 'unresolved',
           error: attachPlaybookFailureCause(error, decided),
@@ -4911,6 +5656,7 @@ export function createXStatePlaybookRuntime<
         error instanceof Error
           ? error
           : new Error(`${label} governed outcome remains unresolved: ${reason}`);
+      failureCauses.retain(failure, decided);
       return {
         status: 'unresolved',
         error: attachPlaybookFailureCause(
@@ -4971,12 +5717,46 @@ export function createXStatePlaybookRuntime<
         ...(semanticCandidate === undefined ? {} : { semanticCandidate }),
         correctionBudget: { limit: 1, spent: true },
       };
+      // DR-067 §1 / PBRT-69: a cohort's shared receipt becomes visible for
+      // every member in one ledger revision — publishing only this member's
+      // spend would leave the invalid half-complete cohort the ledger admits
+      // nowhere.
+      const cohortMembers =
+        current.cohortId === undefined
+          ? [current]
+          : currentLedger.boundaries.filter(
+              ({ cohortId }) => cohortId === current.cohortId,
+            );
+      const replacements = cohortMembers.map((member) => {
+        if (member.boundaryId === current.boundaryId) {
+          return { expected: current, next };
+        }
+        if (
+          member.physicalReceipt !== undefined &&
+          !isDeepStrictEqual(member.physicalReceipt, receipt)
+        ) {
+          throw new TypeError(
+            `${label} correction budget cohort conflicts with its shared repository receipt`,
+          );
+        }
+        return {
+          expected: member,
+          next: {
+            ...member,
+            ...(receipt.after === undefined ? {} : { after: receipt.after }),
+            physicalReceipt: receipt,
+          },
+        };
+      }) as [
+        { readonly expected: PlaybookEffectBoundary; readonly next: PlaybookEffectBoundary },
+        ...{
+          readonly expected: PlaybookEffectBoundary;
+          readonly next: PlaybookEffectBoundary;
+        }[],
+      ];
       const acknowledged = assertPlaybookEffectLedger(
         await effectLedgerCapability.writeAhead([
-          {
-            kind: 'replace-boundaries',
-            replacements: [{ expected: current, next }],
-          },
+          { kind: 'replace-boundaries', replacements },
         ]),
         `${label} semantic correction budget acknowledgement`,
       );
@@ -5362,7 +6142,7 @@ export function createXStatePlaybookRuntime<
     function acknowledgeGovernedPlayerResult(
       value: unknown,
       boundaryId: string,
-      source: 'runExclusive' | 'runDeferred' = 'runExclusive',
+      source: 'runExclusive' | 'runDeferred' | 'runCohort' = 'runExclusive',
     ): PlayerResult {
       if (!isPlainObject(value) || !isPlainObject(value.operation)) {
         throw new TypeError(
@@ -5473,7 +6253,7 @@ export function createXStatePlaybookRuntime<
           );
           governedOutput = undefined;
         }
-      } else if (source === 'runExclusive' && value.deferredStatus !== undefined) {
+      } else if (source !== 'runDeferred' && value.deferredStatus !== undefined) {
         throw new TypeError(
           `${label} non-deferred settlement returned a deferred binding status`,
         );
@@ -5633,6 +6413,371 @@ export function createXStatePlaybookRuntime<
       failedGovernedAttemptId = attemptIds.values().next().value;
     }
 
+    // -----------------------------------------------------------------
+    // DR-067 §1: the parallel profile's repository cohort. The working
+    // leaves of one parallel state entered together run under one
+    // `runCohort` claim, each member an `unchanged` boundary: a member's
+    // result is adjudicated through the one reconciler in serial, a spent
+    // correction rewrites every member's boundary in one acknowledged batch,
+    // members are acknowledged and released in completion order, and a
+    // member's failure cancels its siblings and fails the cohort with the
+    // cause decided first.
+    // -----------------------------------------------------------------
+
+    function trackBoundaryCall<T>(call: Promise<T>): Promise<T> {
+      if (parallelProfile === undefined) return call;
+      activeBoundaryCalls.add(call);
+      const forget = (): void => {
+        activeBoundaryCalls.delete(call);
+      };
+      void call.then(forget, forget);
+      return call;
+    }
+
+    async function drainBoundaryCalls(): Promise<void> {
+      while (activeBoundaryCalls.size > 0) {
+        await Promise.allSettled([...activeBoundaryCalls]);
+      }
+    }
+
+    function cohortParallelStateFor(
+      stateId: string,
+    ): XStateParallelState | undefined {
+      const parallelState =
+        parallelProfile?.parallelStateByWorkingStateId.get(stateId);
+      if (parallelState === undefined) return undefined;
+      if (
+        consumedCohortBoundaries.get(parallelState.stateId) ===
+        publicBoundarySequence
+      ) {
+        return undefined;
+      }
+      const pending = pendingCohorts.get(parallelState.stateId);
+      if (
+        pending !== undefined &&
+        pending.boundarySequence === publicBoundarySequence &&
+        !pending.started
+      ) {
+        return parallelState;
+      }
+      const active = currentState().activeStateIds;
+      return parallelState.regions.every(({ workingStateId }) =>
+        active.includes(workingStateId),
+      )
+        ? parallelState
+        : undefined;
+    }
+
+    function startCohort(
+      parallelState: XStateParallelState,
+      cohort: PendingCohort,
+    ): void {
+      cohort.started = true;
+      consumedCohortBoundaries.set(
+        parallelState.stateId,
+        cohort.boundarySequence,
+      );
+      if (pendingCohorts.get(parallelState.stateId) === cohort) {
+        pendingCohorts.delete(parallelState.stateId);
+      }
+    }
+
+    async function joinCohort(
+      parallelState: XStateParallelState,
+      member: XStateCohortMember,
+    ): Promise<PlayerResult> {
+      let cohort = pendingCohorts.get(parallelState.stateId);
+      if (
+        cohort === undefined ||
+        cohort.boundarySequence !== publicBoundarySequence ||
+        cohort.started
+      ) {
+        cohort = {
+          boundarySequence: publicBoundarySequence,
+          members: new Map(),
+          started: false,
+        };
+        pendingCohorts.set(parallelState.stateId, cohort);
+      }
+      const registered = cohort;
+      if (registered.members.has(member.region.key)) {
+        throw new Error(
+          `${label} parallel state ${parallelState.stateId} registered region ${member.region.key} twice`,
+        );
+      }
+      registered.members.set(member.region.key, member);
+      // A member whose invocation stops before every sibling registered —
+      // its region exited, or the boundary aborted — leaves no cohort to
+      // run: each registered member settles with its own cancellation and
+      // the boundary's cohort is spent.
+      const withdraw = (): void => {
+        if (registered.started) return;
+        startCohort(parallelState, registered);
+        for (const candidate of registered.members.values()) {
+          candidate.settled.reject(
+            candidate.signal.aborted
+              ? candidate.signal.reason
+              : member.signal.reason,
+          );
+        }
+      };
+      if (member.signal.aborted) {
+        withdraw();
+      } else {
+        member.signal.addEventListener('abort', withdraw, { once: true });
+      }
+      if (
+        !registered.started &&
+        registered.members.size === parallelState.regions.length
+      ) {
+        startCohort(parallelState, registered);
+        void settleCohort(parallelState, registered);
+      }
+      return await member.settled.promise;
+    }
+
+    async function settleCohort(
+      parallelState: XStateParallelState,
+      cohort: PendingCohort,
+    ): Promise<void> {
+      const members = parallelState.regions.map(
+        ({ key }) => cohort.members.get(key)!,
+      );
+      const cancellation = new AbortController();
+      const completionOrder: XStateCohortMember[] = [];
+      const decided = new Map<
+        XStateCohortMember,
+        {
+          readonly error: unknown;
+          readonly cause: PlaybookFailureCause | undefined;
+          readonly sequence: number;
+        }
+      >();
+      let decisionSequence = 0;
+      // DR-063 §2: each member failure is one decision, ordered as it was
+      // decided, with the cause decided for exactly that value at that
+      // moment — so a value a sibling later rethrows cannot rename it.
+      const decide = (
+        member: XStateCohortMember,
+        error: unknown,
+        cause: PlaybookFailureCause | undefined = failureCauses.causeOf(error),
+      ): void => {
+        if (decided.has(member)) return;
+        decided.set(member, { error, cause, sequence: ++decisionSequence });
+      };
+      const isCancellation = (error: unknown): boolean =>
+        cancellation.signal.aborted &&
+        Object.is(error, cancellation.signal.reason) &&
+        !activeAborts?.isAbortReason(error);
+      const operationFor =
+        (member: XStateCohortMember) =>
+        async (
+          context:
+            | { readonly baseline?: PlaybookRepositoryReceipt['baseline'] }
+            | undefined,
+        ): Promise<PlayerResult> => {
+          const callSignal = combineAbortSignals(
+            member.signal,
+            cancellation.signal,
+          );
+          try {
+            if (activePlayerKeys.has(member.playerKey)) {
+              await member.reportCollision(callSignal);
+            }
+            activePlayerKeys.add(member.playerKey);
+            try {
+              const result = await member.run(
+                callSignal,
+                cancellation.signal,
+                effectAuthorizedPreExistingBlock(
+                  member.effectBoundary,
+                  context?.baseline,
+                ),
+              );
+              if (result.status !== 'ok' && !cancellation.signal.aborted) {
+                // DR-063 §2: the failure built for a non-`ok` member result
+                // carries the cause decided for exactly that result, and its
+                // siblings are cancelled with it.
+                const cause =
+                  resultFailureCauses.get(result) ??
+                  runtimeDefectCause(
+                    `callPlayer status ${JSON.stringify(result.status)}`,
+                  );
+                const failure = attachPlaybookFailureCause(
+                  markFsmResultFailure(
+                    new Error(
+                      result.error ??
+                        `captainBridge: callPlayer status "${result.status}"`,
+                    ),
+                  ),
+                  cause,
+                );
+                failureCauses.retain(failure, cause);
+                decide(member, failure, cause);
+                cancellation.abort(failure);
+              }
+              return result;
+            } finally {
+              activePlayerKeys.delete(member.playerKey);
+            }
+          } catch (error) {
+            if (!isCancellation(error)) decide(member, error);
+            if (!cancellation.signal.aborted) cancellation.abort(error);
+            throw error;
+          } finally {
+            completionOrder.push(member);
+          }
+        };
+      const completeEffectBoundary = (
+        completion: XStateRepositoryCohortCompletion<PlayerResult>,
+      ): Promise<XStateRepositoryCompletionEvidence> =>
+        cohortCompletionQueue.add(async () => {
+          const member = members.find(
+            ({ roleId }) => roleId === completion.roleId,
+          );
+          if (
+            member === undefined ||
+            completion.boundary.boundaryId !== member.effectBoundary.boundaryId
+          ) {
+            throw new TypeError(
+              `${label} repository cohort completed an undeclared member`,
+            );
+          }
+          const evidence = await completionEvidenceFor(
+            member.input,
+            member.roleId,
+            member.playerId,
+            member.signal,
+            undefined,
+          )(completion);
+          const settlement = governedSettlementsByBoundaryId.get(
+            member.effectBoundary.boundaryId,
+          );
+          if (settlement?.status === 'unresolved') {
+            decide(member, settlement.error);
+          }
+          return evidence;
+        }) as Promise<XStateRepositoryCompletionEvidence>;
+      const runSignal = activeSignal ?? members[0]!.signal;
+      const invocationId = randomUUID();
+      let settled: XStateRepositoryCohortResult<PlayerResult>;
+      try {
+        for (const member of members) member.signal.throwIfAborted();
+        settled = await repositoryCapability!.runCohort!<PlayerResult>({
+          signal: runSignal,
+          invocationId,
+          roleIds: members.map(({ roleId }) => roleId),
+          dispositionsByRole: Object.fromEntries(
+            members.map(({ roleId }) => [roleId, ['unchanged'] as const]),
+          ),
+          effectBoundaries: Object.fromEntries(
+            members.map(({ roleId, effectBoundary }) => [
+              roleId,
+              effectBoundary,
+            ]),
+          ),
+          operations: Object.fromEntries(
+            members.map((member) => [member.roleId, operationFor(member)]),
+          ),
+          completeEffectBoundary,
+        });
+        if (!isPlainObject(settled) || settled.invocationId !== invocationId) {
+          throw new TypeError(
+            `${label} repository cohort changed its invocation identity`,
+          );
+        }
+      } catch (error) {
+        for (const member of members) {
+          governedSettlementsByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          governedCompletionEvidenceByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          refreshGovernedBoundaryStart(member.effectBoundary.boundaryId);
+        }
+        if (!isAbortFailure(error, runSignal)) controlPlaneError ??= error;
+        for (const member of members) member.settled.reject(error);
+        return;
+      }
+      const releaseOrder = [
+        ...completionOrder,
+        ...members.filter((member) => !completionOrder.includes(member)),
+      ];
+      const acknowledged = new Map<XStateCohortMember, PlayerResult>();
+      const failures = new Map<XStateCohortMember, unknown>();
+      for (const member of releaseOrder) {
+        const operation = isPlainObject(settled.operations)
+          ? settled.operations[member.roleId]
+          : undefined;
+        try {
+          const result = acknowledgeGovernedPlayerResult(
+            {
+              operation,
+              receipt: isPlainObject(settled.receipts)
+                ? settled.receipts[member.roleId]
+                : undefined,
+              effectLedger: settled.effectLedger,
+            },
+            member.effectBoundary.boundaryId,
+            'runCohort',
+          );
+          acknowledged.set(member, result);
+          const settlement = governedPlayerSettlements.get(result);
+          if (settlement?.status === 'unresolved') {
+            failures.set(member, settlement.error);
+          } else if (result.status !== 'ok') {
+            failures.set(member, decided.get(member)?.error);
+          }
+        } catch (error) {
+          failures.set(member, error);
+          const operationReason =
+            isPlainObject(operation) &&
+            operation.status === 'rejected' &&
+            Object.is(operation.reason, error);
+          if (!operationReason) {
+            // An acknowledgement the host could not prove is a control-plane
+            // defect, exactly as on the exclusive path.
+            if (!isAbortFailure(error, runSignal)) controlPlaneError ??= error;
+            decide(member, error);
+          }
+        } finally {
+          governedSettlementsByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+          governedCompletionEvidenceByBoundaryId.delete(
+            member.effectBoundary.boundaryId,
+          );
+        }
+      }
+      if (failures.size === 0) {
+        for (const member of releaseOrder) {
+          member.settled.resolve(acknowledged.get(member)!);
+        }
+        return;
+      }
+      for (const result of acknowledged.values()) {
+        governedPlayerSettlements.delete(result);
+      }
+      const first = [...decided.values()].sort(
+        (left, right) => left.sequence - right.sequence,
+      )[0];
+      const failure =
+        first?.error ??
+        failures.get(releaseOrder.find((member) => failures.has(member))!) ??
+        markFsmResultFailure(
+          new Error(
+            `${label} parallel state ${parallelState.stateId} cohort failed`,
+          ),
+        );
+      const cause = first?.cause ?? failureCauses.causeOf(failure);
+      if (cause !== undefined) {
+        failureCauses.retain(failure, cause);
+        attachPlaybookFailureCause(failure, cause);
+      }
+      for (const member of members) member.settled.reject(failure);
+    }
+
     const boundary: RuntimeBoundaryCalls = {
       async callPlayer(
         input,
@@ -5690,16 +6835,192 @@ export function createXStatePlaybookRuntime<
         };
 
         const playerKey = continuationKey(roleId, playerId);
-        if (activePlayerKeys.has(playerKey)) {
+        const runTracedPlayerCall = async (
+          resume: string | false = selectedResume,
+          // DR-062 §4: composed from this call's own baseline observation,
+          // so the prompt the trace records is the prompt the player is sent.
+          preExistingBlock?: string,
+          // DR-067 §1: a cohort member's call signal also carries its
+          // cohort's sibling cancellation.
+          callSignal: AbortSignal = signal,
+          cohortCancellation?: AbortSignal,
+        ): Promise<PlayerResult> => {
+          const identity = callIdentity(resume);
+          // DR-067 §1: a parallel machine classifies aborts per call, so a
+          // trace sink rejecting with a sibling's cancellation is forgiven
+          // for that call alone.
+          const traceAborts =
+            parallelProfile === undefined
+              ? undefined
+              : abortReasonClassifier(callSignal, activeAborts);
+          const withPreExisting = (text: string): string =>
+            preExistingBlock === undefined
+              ? text
+              : `${text}\n\n${preExistingBlock}`;
+          const callPrompt = withPreExisting(
+            resume === false ? freshPrompt : prompt,
+          );
+          const callFreshPrompt = withPreExisting(freshPrompt);
+          await emitCallStarted(
+            'player.call.started',
+            'player.call.finished',
+            { ...identity, prompt: callPrompt },
+            position,
+            callSignal,
+            undefined,
+            traceAborts,
+          );
+
+          let rawResult: unknown;
+          try {
+            // An abort may land while the awaited started emission drains
+            // (e.g. fired from the trace sink itself); the host call must
+            // never start after abort, so settle the already-started pair
+            // as `aborted` through the catch below.
+            callSignal.throwIfAborted();
+            rawResult = await requireHostPorts().callPlayer(
+              roleId,
+              callPrompt,
+              callSignal,
+              {
+                resume,
+                ...(callPrompt === callFreshPrompt
+                  ? {}
+                  : { freshPrompt: callFreshPrompt }),
+              },
+            );
+            // A host promise is not required to honor cancellation. Do not
+            // let a late result mutate continuity or publish a successful
+            // finish.
+            callSignal.throwIfAborted();
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                {
+                  ...identity,
+                  status: isAbortFailure(error, callSignal)
+                    ? 'aborted'
+                    : 'error',
+                  error: normalizeError(error),
+                },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The original non-abort port rejection remains authoritative.
+            }
+            // A thrown port call carries no authoritative result, so the
+            // prior token remains available for a later explicit resume.
+            throw decidePlayerCallFailure(
+              error,
+              roleId,
+              playerId,
+              callSignal,
+              cohortCancellation,
+            );
+          }
+
+          let result: PlayerResult;
+          try {
+            result = validatePlayerResult(rawResult);
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                { ...identity, status: 'error', error: normalizeError(error) },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The malformed host result remains authoritative.
+            }
+            throw decidePlayerCallFailure(
+              error,
+              roleId,
+              playerId,
+              callSignal,
+              cohortCancellation,
+            );
+          }
+
+          try {
+            updatePlayerResume(roleId, playerId, result);
+          } catch (error) {
+            if (!isAbortFailure(error, callSignal)) controlPlaneError ??= error;
+            try {
+              await emitTrace(
+                'player.call.finished',
+                { ...identity, status: 'error', error: normalizeError(error) },
+                position,
+                traceAborts,
+              );
+            } catch {
+              // The continuation-store failure remains authoritative.
+            }
+            throw error;
+          }
+
+          await emitTrace(
+            'player.call.finished',
+            {
+              ...identity,
+              status: result.status,
+              ...(result.finalText !== undefined
+                ? { finalText: result.finalText }
+                : {}),
+              ...(result.error !== undefined
+                ? { error: normalizeError(result.error) }
+                : {}),
+              ...(result.resumeToken !== undefined
+                ? { resumeToken: result.resumeToken }
+                : {}),
+            },
+            position,
+            traceAborts,
+          );
+          // DR-063 §2: the player bridge builds the failure Error for a
+          // non-`ok` result, so the cause is decided here, where the role,
+          // the player, and the reported error are known, and a successful
+          // result clears it so no later failure inherits it.
+          if (result.status === 'ok') {
+            pendingResultFailureCause = undefined;
+          } else if (result.status === 'aborted') {
+            pendingResultFailureCause = ABORTED_FAILURE_CAUSE;
+          } else {
+            pendingResultFailureCause = playerFailureCause({
+              roleId,
+              ...(playerId === undefined ? {} : { playerId }),
+              error:
+                result.error ??
+                `callPlayer status ${JSON.stringify(result.status)}`,
+            });
+          }
+          if (pendingResultFailureCause !== undefined) {
+            resultFailureCauses.set(result, pendingResultFailureCause);
+          }
+          return result;
+        };
+        const reportPlayerKeyCollision = async (
+          callSignal: AbortSignal,
+        ): Promise<never> => {
           const error = new Error(
             `simultaneous calls to player key ${playerKey} are not allowed`,
           );
+          const traceAborts =
+            parallelProfile === undefined
+              ? undefined
+              : abortReasonClassifier(callSignal, activeAborts);
           await emitCallStarted(
             'player.call.started',
             'player.call.finished',
             { ...callIdentity(selectedResume), prompt },
             position,
-            signal,
+            callSignal,
+            undefined,
+            traceAborts,
           );
           await emitTrace(
             'player.call.finished',
@@ -5709,149 +7030,63 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(error),
             },
             position,
+            traceAborts,
           );
           throw error;
-        }
-        activePlayerKeys.add(playerKey);
+        };
 
-        try {
-          const runTracedPlayerCall = async (
-            resume: string | false = selectedResume,
-            // DR-062 §4: composed from this call's own baseline observation,
-            // so the prompt the trace records is the prompt the player is sent.
-            preExistingBlock?: string,
-          ): Promise<PlayerResult> => {
-            const identity = callIdentity(resume);
-            const withPreExisting = (text: string): string =>
-              preExistingBlock === undefined
-                ? text
-                : `${text}\n\n${preExistingBlock}`;
-            const callPrompt = withPreExisting(
-              resume === false ? freshPrompt : prompt,
-            );
-            const callFreshPrompt = withPreExisting(freshPrompt);
-            await emitCallStarted(
-              'player.call.started',
-              'player.call.finished',
-              { ...identity, prompt: callPrompt },
-              position,
-              signal,
+        // DR-067 §1: the working leaves of one parallel state entered
+        // together run as one all-`unchanged` repository cohort, at most once
+        // per public boundary; a corrective re-ask and a single region
+        // resuming after its Boss reply take the exclusive path below.
+        const cohortState =
+          deferredContinuation === undefined
+            ? cohortParallelStateFor(input.stateId)
+            : undefined;
+        if (cohortState !== undefined) {
+          const effectBoundary = governedBoundarySeed(
+            input,
+            roleId,
+            callId,
+            turnId,
+          );
+          if (
+            effectBoundary === undefined ||
+            repositoryCapability?.runCohort === undefined
+          ) {
+            throw new Error(
+              `${label} parallel state ${cohortState.stateId} requires governed player states and repository.runCohort`,
             );
+          }
+          activeGovernedBoundarySeen = true;
+          return await joinCohort(cohortState, {
+            region: cohortState.regions.find(
+              ({ workingStateId }) => workingStateId === input.stateId,
+            )!,
+            input,
+            roleId,
+            playerId,
+            playerKey,
+            signal,
+            effectBoundary,
+            run: (callSignal, cohortCancellation, preExistingBlock) =>
+              runTracedPlayerCall(
+                selectedResume,
+                preExistingBlock,
+                callSignal,
+                cohortCancellation,
+              ),
+            reportCollision: reportPlayerKeyCollision,
+            settled: deferredValue<PlayerResult>(),
+          });
+        }
 
-            let rawResult: unknown;
-            try {
-              // An abort may land while the awaited started emission drains
-              // (e.g. fired from the trace sink itself); the host call must
-              // never start after abort, so settle the already-started pair
-              // as `aborted` through the catch below.
-              signal.throwIfAborted();
-              rawResult = await requireHostPorts().callPlayer(
-                roleId,
-                callPrompt,
-                signal,
-                {
-                  resume,
-                  ...(callPrompt === callFreshPrompt
-                    ? {}
-                    : { freshPrompt: callFreshPrompt }),
-                },
-              );
-              // A host promise is not required to honor cancellation. Do not
-              // let a late result mutate continuity or publish a successful
-              // finish.
-              signal.throwIfAborted();
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  {
-                    ...identity,
-                    status: isAbortFailure(error, signal) ? 'aborted' : 'error',
-                    error: normalizeError(error),
-                  },
-                  position,
-                );
-              } catch {
-                // The original non-abort port rejection remains authoritative.
-              }
-              // A thrown port call carries no authoritative result, so the
-              // prior token remains available for a later explicit resume.
-              throw decidePlayerCallFailure(error, roleId, playerId, signal);
-            }
-
-            let result: PlayerResult;
-            try {
-              result = validatePlayerResult(rawResult);
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  { ...identity, status: 'error', error: normalizeError(error) },
-                  position,
-                );
-              } catch {
-                // The malformed host result remains authoritative.
-              }
-              throw decidePlayerCallFailure(error, roleId, playerId, signal);
-            }
-
-            try {
-              updatePlayerResume(roleId, playerId, result);
-            } catch (error) {
-              if (!isAbortFailure(error, signal)) controlPlaneError ??= error;
-              try {
-                await emitTrace(
-                  'player.call.finished',
-                  { ...identity, status: 'error', error: normalizeError(error) },
-                  position,
-                );
-              } catch {
-                // The continuation-store failure remains authoritative.
-              }
-              throw error;
-            }
-
-            await emitTrace(
-              'player.call.finished',
-              {
-                ...identity,
-                status: result.status,
-                ...(result.finalText !== undefined
-                  ? { finalText: result.finalText }
-                  : {}),
-                ...(result.error !== undefined
-                  ? { error: normalizeError(result.error) }
-                  : {}),
-                ...(result.resumeToken !== undefined
-                  ? { resumeToken: result.resumeToken }
-                  : {}),
-              },
-              position,
-            );
-            // DR-063 §2: the player bridge builds the failure Error for a
-            // non-`ok` result, so the cause is decided here, where the role,
-            // the player, and the reported error are known, and a successful
-            // result clears it so no later failure inherits it.
-            if (result.status === 'ok') {
-              lastFailureCause = undefined;
-            } else if (result.status === 'aborted') {
-              rememberFailureCause(ABORTED_FAILURE_CAUSE);
-            } else {
-              rememberFailureCause(
-                playerFailureCause({
-                  roleId,
-                  ...(playerId === undefined ? {} : { playerId }),
-                  error:
-                    result.error ??
-                    `callPlayer status ${JSON.stringify(result.status)}`,
-                }),
-              );
-            }
-            return result;
-          };
+        if (activePlayerKeys.has(playerKey)) {
+          await reportPlayerKeyCollision(signal);
+        }
+        activePlayerKeys.add(playerKey);
 
+        try {
           const effectBoundary = governedBoundarySeed(
             input,
             roleId,
@@ -5956,10 +7191,13 @@ export function createXStatePlaybookRuntime<
         }
       },
 
-      markPlayerResultFailure(error): Error {
-        return lastFailureCause === undefined
-          ? error
-          : attachPlaybookFailureCause(error, lastFailureCause);
+      markPlayerResultFailure(error, result): Error {
+        const cause =
+          (result === undefined ? undefined : resultFailureCauses.get(result)) ??
+          pendingResultFailureCause;
+        if (cause === undefined) return error;
+        failureCauses.retain(error, cause);
+        return attachPlaybookFailureCause(error, cause);
       },
 
       takeGovernedPlayerOutput(result): GovernedPlayerSettlement | undefined {
@@ -6200,6 +7438,16 @@ export function createXStatePlaybookRuntime<
         }) as Promise<CaptainResult>;
       },
     };
+    if (parallelProfile !== undefined) {
+      // DR-067 §1: a parallel machine's boundary drain waits for every player
+      // and judge call it started.
+      const untrackedCallPlayer = boundary.callPlayer;
+      const untrackedCallJudge = boundary.callJudge;
+      boundary.callPlayer = (input, roleId, freshPrompt, signal) =>
+        trackBoundaryCall(untrackedCallPlayer(input, roleId, freshPrompt, signal));
+      boundary.callJudge = (purpose, stateId, prompt, signal) =>
+        trackBoundaryCall(untrackedCallJudge(purpose, stateId, prompt, signal));
+    }
 
     function playerActor(
       ports: PlaybookPorts,
@@ -6526,8 +7774,12 @@ export function createXStatePlaybookRuntime<
     const nestedBridge = createNestedPlaybookBridge({
       nextCallId: () => `playbook-${++playbookCallSequence}`,
       getBoundarySignal: () => activeSignal,
-      callPlaybook: (request, signal) =>
-        requireHostPorts().callPlaybook(request, signal),
+      callPlaybook: (request, signal) => {
+        const call = requireHostPorts().callPlaybook(request, signal);
+        return parallelProfile === undefined
+          ? call
+          : trackBoundaryCall(Promise.resolve(call));
+      },
       emitStarted: async (event, aborts) => {
         playbookCallTurnIds.set(event.callId, activeTurnId);
         if (hasGovernedPlayerStates) {
@@ -6578,7 +7830,8 @@ export function createXStatePlaybookRuntime<
         activeAborts = aborts ?? abortReasonClassifier(signal);
       },
       bindActorSettlement: (aborts) => {
-        actorSettlementAborts = aborts;
+        if (parallelProfile === undefined) actorSettlementAborts.length = 0;
+        actorSettlementAborts.push(aborts);
       },
       onControlPlaneError: (error, aborts) => {
         // The shared bridge classifies before reporting against its own
@@ -6619,18 +7872,50 @@ export function createXStatePlaybookRuntime<
       }
       return {
         ...normalized,
-        cause: lastFailureCause ?? runtimeDefectCause(normalized.message),
+        cause:
+          failureCauses.causeOf(context.lastError) ??
+          runtimeDefectCause(normalized.message),
       };
     }
 
+    // DR-063 §2: the failure that parks the machine is the error its parking
+    // transition carried, but a compiled machine keeps a JSON-safe record of
+    // it as `lastError` (gears2fsm requires JSON-safe context), so neither
+    // that value's identity nor its marker reaches the failed state. The cause
+    // decided for the carried error is retained under the value the machine
+    // kept, so every surface of this turn and of each later one publishes the
+    // runtime's own decision for as long as that failure stands. A kept value
+    // that already answers keeps its cause.
+    function bindParkedFailureCause(
+      context: Record<string, unknown>,
+      event: unknown,
+    ): void {
+      const kept = context.lastError;
+      if (kept === undefined || kept === null) return;
+      if (failureCauses.causeOf(kept) !== undefined) return;
+      const decided = failureCauses.causeOf(actorErrorOf(event));
+      if (decided !== undefined) failureCauses.retain(kept, decided);
+    }
+
     // DR-063 §2: a rejected player port or a result the runtime cannot read is
-    // a `player-failed` failure named by role; an abort is `aborted`.
+    // a `player-failed` failure named by role; an abort is `aborted`. A
+    // cancellation the runtime itself issued to a cohort member because its
+    // sibling failed is not this player's failure and decides nothing, so the
+    // originator's cause stands (DR-067 §1, playbook-55).
     function decidePlayerCallFailure(
       error: unknown,
       roleId: string,
       playerId: string | undefined,
       signal: AbortSignal,
+      cohortCancellation?: AbortSignal,
     ): unknown {
+      if (
+        cohortCancellation?.aborted === true &&
+        Object.is(error, cohortCancellation.reason) &&
+        !activeAborts?.isAbortReason(error)
+      ) {
+        return error;
+      }
       const cause = isAbortFailure(error, signal)
         ? ABORTED_FAILURE_CAUSE
         : playerFailureCause({
@@ -6638,7 +7923,7 @@ export function createXStatePlaybookRuntime<
             ...(playerId === undefined ? {} : { playerId }),
             error,
           });
-      rememberFailureCause(cause);
+      failureCauses.retain(error, cause);
       return attachPlaybookFailureCause(error, cause);
     }
 
@@ -6689,12 +7974,21 @@ export function createXStatePlaybookRuntime<
         previousState: previousState ?? null,
         state,
       };
-      const pendingBossQuestion = pendingBossQuestionForState(state, context);
-      if (
-        pendingBossQuestion !== undefined &&
-        !hasUnresolvedReconciliation()
-      ) {
-        payload.pendingBossQuestion = pendingBossQuestion;
+      if (parallelProfile === undefined) {
+        const pendingBossQuestion = pendingBossQuestionForState(state, context);
+        if (
+          pendingBossQuestion !== undefined &&
+          !hasUnresolvedReconciliation()
+        ) {
+          payload.pendingBossQuestion = pendingBossQuestion;
+        }
+      } else if (!hasUnresolvedReconciliation()) {
+        // DR-067 §1: a parallel machine's telemetry carries every question
+        // pending in an active wait, in the plural.
+        const pendingBossQuestions = pendingBossQuestionsFor(state, context);
+        if (pendingBossQuestions.length > 0) {
+          payload.pendingBossQuestions = pendingBossQuestions;
+        }
       }
       if (state.stateId === 'failed') {
         const lastError = failedStateError(context);
@@ -6729,7 +8023,7 @@ export function createXStatePlaybookRuntime<
             message,
             ...(data === undefined ? {} : { data }),
             state,
-            ...stateIdentity(state.stateId),
+            ...stateIdentity(statusTraceStateId(state)),
           },
           position,
         ),
@@ -6779,8 +8073,7 @@ export function createXStatePlaybookRuntime<
     function consumeActorSettlementAborts(
       forSnapshot = false,
     ): AbortReasonClassifier | undefined {
-      const aborts = actorSettlementAborts ?? actorSettlementErrorAborts;
-      actorSettlementAborts = undefined;
+      const aborts = actorSettlementAborts.shift() ?? actorSettlementErrorAborts;
       actorSettlementErrorAborts = undefined;
       if (forSnapshot && aborts !== undefined) {
         // XState can report an errored root through both its inspection
@@ -6852,7 +8145,14 @@ export function createXStatePlaybookRuntime<
           try {
             const snap = inspectionEvent.snapshot;
             const state = normalizePlaybookSnapshot(snap);
-            if (state.stateId === undefined) {
+            if (
+              state.stateId === undefined &&
+              !(
+                parallelProfile?.states.some(({ stateId }) =>
+                  state.activeStateIds.includes(stateId),
+                ) ?? false
+              )
+            ) {
               throw new Error(
                 `${label} root snapshot must expose exactly one playbook state id`,
               );
@@ -6882,6 +8182,9 @@ export function createXStatePlaybookRuntime<
             }
             const context = ((snap as { context?: unknown }).context ??
               {}) as Record<string, unknown>;
+            if (state.stateId === 'failed') {
+              bindParkedFailureCause(context, inspectionEvent.event);
+            }
             if (
               state.stateId === BOSS_REPLY_WAIT_STATE_ID &&
               deferredReconciliationOperationId !== undefined
@@ -6903,7 +8206,9 @@ export function createXStatePlaybookRuntime<
               context,
             );
             const stateStatuses = completeFailedStatuses(
-              statusesForState(state, context, inspectionEvent.event),
+              bossRelevantStateIds !== undefined && usesDefaultStatuses
+                ? parallelStatusesFor(previousState, state, context)
+                : statusesForState(state, context, inspectionEvent.event),
               state,
               context,
             );
@@ -7110,13 +8415,17 @@ export function createXStatePlaybookRuntime<
       emissionQueue.clear();
       judgeQueue.clear();
       appliedReceipts.clear();
+      pendingCohorts.clear();
+      consumedCohortBoundaries.clear();
+      activeBoundaryCalls.clear();
+      cohortCompletionQueue.clear();
       actor = undefined;
       session = undefined;
       savedPorts = undefined;
       runtimePorts = undefined;
       activeSignal = undefined;
       activeAborts = undefined;
-      actorSettlementAborts = undefined;
+      actorSettlementAborts.length = 0;
       actorSettlementErrorAborts = undefined;
       activeAbortEmission = undefined;
       activeTurnId = undefined;
@@ -7206,12 +8515,12 @@ export function createXStatePlaybookRuntime<
     // context member above sources. A candidate whose event the live
     // snapshot does not accept — or whose payload the runtime can source
     // from neither — is excluded rather than completed with invented text.
+    // The caller has already applied the PBRT-71 replay fence.
     function retryActionFor(
       snapshot: unknown,
       stateId: string | undefined,
     ): DerivedControlAction | undefined {
       if (stateId !== 'failed') return undefined;
-      if (!failedAttemptAllowsReplay()) return undefined;
       const retryEvent = retryEventFrom(snapshot);
       if (retryEvent === undefined) return undefined;
       if (!snapshotCan(snapshot, retryEvent)) return undefined;
@@ -7341,6 +8650,15 @@ export function createXStatePlaybookRuntime<
         );
         return derived;
       }
+      // PBRT-71 / DR-040 §4: out of the failure state, a jump restarts the
+      // failed attempt's work exactly as the retry does, so one fence gates
+      // both. Unless every governed boundary of that attempt carries a
+      // complete `unchanged` receipt, neither is advertised — and `apply`,
+      // which revalidates against this list, accepts neither — so no
+      // control can replay a player call whose effect may already exist.
+      if (state.stateId === 'failed' && !failedAttemptAllowsReplay()) {
+        return derived;
+      }
       const retry = retryActionFor(snapshot, state.stateId);
       if (retry !== undefined) derived.push(retry);
       // Jump entries: resumable targets whose explicit-state-jump event the
@@ -7408,9 +8726,12 @@ export function createXStatePlaybookRuntime<
     // state whose source declares no description publishes none: an id is
     // never promoted into a description by default.
     function stateDescriptionFor(state: PlaybookState): string | undefined {
+      // DR-067 §1: inside a parallel state, the meaning published is the
+      // root state's — the parallel parent's own description.
       const keys = [
         ...(state.stateId === undefined ? [] : [state.stateId]),
         ...(typeof state.value === 'string' ? [state.value] : []),
+        ...(isPlainObject(state.value) ? Object.keys(state.value) : []),
         ...state.activeStateIds,
       ];
       for (const key of keys) {
@@ -7781,7 +9102,7 @@ export function createXStatePlaybookRuntime<
         ?.context ?? {}) as Record<string, unknown>;
       const actual =
         state?.stateId === BOSS_REPLY_WAIT_STATE_ID
-          ? pendingBossQuestionFromContext(context)
+          ? singlePendingBossQuestion(state, context)
           : undefined;
       if (!isDeepStrictEqual(actual, expected)) {
         throw new Error(
@@ -8138,7 +9459,7 @@ export function createXStatePlaybookRuntime<
         const state = normalizePlaybookSnapshot(snapshot);
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending = pendingBossQuestionForState(state, context);
+        const pending = singlePendingBossQuestion(state, context);
         if (
           pending === undefined ||
           currentBoundDeferredOperation(pending)?.operationId !== operationId
@@ -8243,19 +9564,25 @@ export function createXStatePlaybookRuntime<
         }
         const state = currentState();
         if (state.status !== 'active' || !state.quiescent) return undefined;
+        const context = (actor.getSnapshot() as { context?: unknown })
+          .context as Record<string, unknown>;
+        // DR-063 §2: the failed state's `lastError` is persisted as every live
+        // surface publishes it, completed from the runtime's own cause slot, so
+        // a thrown value that refused the cause still explains itself after a
+        // restart.
         const machineSnapshot = detachPersistedMachineSnapshot(
           actor.getPersistedSnapshot(),
+          state.stateId === 'failed'
+            ? { lastError: failedStateError(context ?? {}) }
+            : {},
         );
-        const context = (actor.getSnapshot() as { context?: unknown })
-          .context as Record<string, unknown>;
         effectLedgerMirror = currentEffectLedger();
         refreshRetainedEffectReconciliation(effectLedgerMirror);
         syncDeferredReconciliationOverlay();
         refreshUnresolvedSemanticReconciliation(effectLedgerMirror);
-        const pending =
-          !hasUnresolvedReconciliation()
-            ? pendingBossQuestionForState(state, context ?? {})
-            : undefined;
+        const pendingQuestions = !hasUnresolvedReconciliation()
+          ? pendingBossQuestionsFor(state, context ?? {})
+          : [];
         const failedEffectAttempt =
           hasGovernedPlayerStates &&
           state.stateId === 'failed' &&
@@ -8281,17 +9608,12 @@ export function createXStatePlaybookRuntime<
               : {}),
           },
           state,
-          pendingBossQuestions:
-            pending === undefined
-              ? []
-              : [
-                  {
-                    questionId: pending.questionId,
-                    asker: pending.asker,
-                    question: pending.question,
-                    sourceItem: pending.sourceItem,
-                  },
-                ],
+          pendingBossQuestions: pendingQuestions.map((pending) => ({
+            questionId: pending.questionId,
+            asker: pending.asker,
+            question: pending.question,
+            sourceItem: pending.sourceItem,
+          })),
           effectLedger: effectLedgerMirror,
           ...(retainedEffectSourceSessionId === undefined
             ? {}
@@ -8319,17 +9641,23 @@ export function createXStatePlaybookRuntime<
       },
 
       // DR-038 §§1,5 / PBRT-61/PBRT-65: adoption is restore under a fresh
-      // engagement identity and counter lineage, exposed separately so
-      // capability-less bespoke runtimes can omit it. Runtime-visible
-      // preflight mismatches reject before effects; after preflight the new
+      // engagement identity and counter lineage, exposed separately so a
+      // capability-less runtime can omit it. Runtime-visible preflight
+      // mismatches reject before effects; after preflight the new
       // session.started boundary owns failed-start cleanup just like init.
-      async adopt(
-        nextSession: PlaybookSession,
-        snapshot: PlaybookRuntimeSnapshot,
-        context: PlaybookAdoptionContext,
-      ): Promise<void> {
-        await rehydrateSnapshot('adopt', nextSession, snapshot, context);
-      },
+      // DR-067 §2: retained-snapshot adoption stays in the flat domain, so a
+      // machine that declares a parallel state omits the member.
+      ...(parallelProfile === undefined
+        ? {
+            async adopt(
+              nextSession: PlaybookSession,
+              snapshot: PlaybookRuntimeSnapshot,
+              context: PlaybookAdoptionContext,
+            ): Promise<void> {
+              await rehydrateSnapshot('adopt', nextSession, snapshot, context);
+            },
+          }
+        : {}),
 
       // DR-029 / PBRT-52: side-effect-free control view over the live
       // snapshot, valid at parked quiescence outside an active boundary.
@@ -8357,10 +9685,9 @@ export function createXStatePlaybookRuntime<
         const state = currentState();
         const context = ((snapshot as { context?: unknown }).context ??
           {}) as Record<string, unknown>;
-        const pending =
-          !hasUnresolvedReconciliation()
-            ? pendingBossQuestionForState(state, context)
-            : undefined;
+        const pendingQuestions = !hasUnresolvedReconciliation()
+          ? pendingBossQuestionsFor(state, context)
+          : [];
         const lastError =
           state.stateId === 'failed'
             ? failedStateError(context)
@@ -8376,17 +9703,12 @@ export function createXStatePlaybookRuntime<
           ...(projectedContext !== undefined
             ? { context: projectedContext }
             : {}),
-          pendingQuestions:
-            pending === undefined
-              ? []
-              : [
-                  {
-                    questionId: pending.questionId,
-                    asker: pending.asker,
-                    question: pending.question,
-                    sourceItem: pending.sourceItem,
-                  },
-                ],
+          pendingQuestions: pendingQuestions.map((pending) => ({
+            questionId: pending.questionId,
+            asker: pending.asker,
+            question: pending.question,
+            sourceItem: pending.sourceItem,
+          })),
           ...(lastError !== undefined ? { lastError } : {}),
           actions: deriveControlActions(snapshot).map(({ action }) => action),
         });
@@ -8455,6 +9777,7 @@ export function createXStatePlaybookRuntime<
         const callId = `apply-${++applyCallSequence}`;
         const position: TracePosition = { turnId, callId };
         activeTurnId = turnId;
+        publicBoundarySequence += 1;
         beginAutomaticReplayBoundary();
         activeSignal = signal;
         activeAborts = abortReasonClassifier(signal);
@@ -8655,6 +9978,7 @@ export function createXStatePlaybookRuntime<
           if (receipt !== undefined && receipt.disposition !== 'rejected') {
             appliedReceipts.set(key, receipt);
           }
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           try {
             await drainEmissions();
           } catch (error) {
@@ -8758,14 +10082,16 @@ export function createXStatePlaybookRuntime<
         refreshRetainedEffectFenceFromHost();
         const turnId = ++turnSequence;
         activeTurnId = turnId;
+        publicBoundarySequence += 1;
         beginAutomaticReplayBoundary();
         activeSignal = signal;
         activeAborts = abortReasonClassifier(signal);
         activeAbortEmission = undefined;
         controlPlaneError = undefined;
-        // DR-063 §2: each turn decides its own failures, so the slot never
-        // carries a previous turn's cause into this one.
-        lastFailureCause = undefined;
+        // DR-063 §2: each turn decides its own failures, so no pending result
+        // cause carries into this one; a cause decided for a parked failure
+        // stays bound to that failure.
+        pendingResultFailureCause = undefined;
         let result: PlaybookRunResult | undefined;
         let operationError: unknown;
         // The boundary sentinel releases on every exit: a settlement defect
@@ -8798,7 +10124,7 @@ export function createXStatePlaybookRuntime<
               const stateId = normalizePlaybookSnapshot(snapshot).stateId;
               const snapshotContext = ((snapshot as { context?: unknown })
                 .context ?? {}) as Record<string, unknown>;
-              deferredPending = pendingBossQuestionForState(
+              deferredPending = singlePendingBossQuestion(
                 normalizePlaybookSnapshot(snapshot),
                 snapshotContext,
               );
@@ -8965,6 +10291,7 @@ export function createXStatePlaybookRuntime<
             operationError = error;
           }
 
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           let drainError: unknown;
           try {
             await drainEmissions();
@@ -9078,6 +10405,7 @@ export function createXStatePlaybookRuntime<
           return runResultFor('no-action');
         }
         activeTurnId = playbookCallTurnIds.get(input.callId);
+        publicBoundarySequence += 1;
         bindAutomaticReplayBoundary(
           playbookCallEffectPrefixes.has(input.callId)
             ? playbookCallEffectPrefixes.get(input.callId)
@@ -9122,6 +10450,7 @@ export function createXStatePlaybookRuntime<
               error: normalizeError(input.signal.reason),
             };
           }
+          if (parallelProfile !== undefined) await drainBoundaryCalls();
           let drainError: unknown;
           try {
             await drainEmissions();
@@ -9239,10 +10568,14 @@ export function createXStatePlaybookRuntime<
             emissionQueue.clear();
             judgeQueue.clear();
             appliedReceipts.clear();
+            pendingCohorts.clear();
+            consumedCohortBoundaries.clear();
+            activeBoundaryCalls.clear();
+            cohortCompletionQueue.clear();
             actor = undefined;
             activeSignal = undefined;
             activeAborts = undefined;
-            actorSettlementAborts = undefined;
+            actorSettlementAborts.length = 0;
             actorSettlementErrorAborts = undefined;
             activeAbortEmission = undefined;
             activeTurnId = undefined;